Active Directory Extended Rights
Active Directory Extended Rights control special operations that are not covered by the standard set of access rights. By default, there are 60 extended rights in a Windows Server 2025 Active Directory domain.
Active Directory Extended Rights
There are 60 extended rights defined in a Windows Server 2025 Active Directory domain -
| # . |
Name . |
Rights GUID . |
Applies To . |
1 |
Add GUID |
440820ad-65b4-11d1-a3da-0000f875ae0d |
Domain-DNS |
2 |
Allocate Rids |
1abd7cf8-0a99-11d1-adbb-00c04fd8d5cd |
NTDS-DSA |
3 |
Allowed to Authenticate |
68B1D179-0D15-4d4f-AB71-46152E79A7BC |
ms-DS-Delegated-Managed-Service-Account, ms-DS-Group-Managed-Service-Account, inetOrgPerson, User, ms-DS-Managed-Service-Account, Computer |
4 |
Apply Group Policy |
edacfd8f-ffb3-11d1-b41d-00a0c968f939 |
Group Policy Container |
5 |
AutoEnrollment |
a05b8cc2-17bc-4802-a710-e7c15ab866a2 |
PKI-Certificate-Template |
6 |
Enroll |
0e10c968-78fb-11d2-90d4-00c04f79dc55 |
PKI-Certificate-Template |
7 |
Change Domain Master |
014bf69c-7b3b-11d1-85f6-08002be74fab |
Cross-Ref-Container |
8 |
Change Infrastructure Master |
cc17b1fb-33d9-11d2-97d4-00c04fd8d5cd |
Infrastructure-Update |
9 |
Change PDC |
bae50096-4752-11d1-9052-00c04fc2d4cf |
Domain DNS |
10 |
Change Rid Master |
d58d5f36-0a98-11d1-adbb-00c04fd8d5cd |
RID-Manager |
11 |
Change Schema Master |
e12b56b6-0a95-11d1-adbb-00c04fd8d5cd |
DMD/td>
|
12 |
Create Inbound Forest Trust |
e2a36dc9-ae17-47c3-b58b-be34c55ba633 |
Domain-DNS |
13 |
Do Garbage Collection |
fec364e0-0a98-11d1-adbb-00c04fd8d5cd |
NTDS-DSA |
14 |
Domain Administer Server |
ab721a52-1e2f-11d0-9819-00aa0040529b |
Sam-Server |
15 |
Bypass the quota restrictions during creation |
88a9933e-e5c8-4f2a-9dd7-2527416b8092 |
26f11b08-a29d-4869-99bb-ef0b99fd883e |
16 |
Check Stale Phantoms |
69ae6200-7f46-11d2-b9ad-00c04f79f805 |
NTDS-DSA |
17 |
Allow a DC to create a clone of itself |
3e0f7e18-2c7a-4c10-ba82-4d926db99a3e |
Domain DNS |
18 |
Execute Forest Update Script |
2f16c4a5-b98e-432c-952a-cb388ba33f2e |
Cross-Ref-Container |
19 |
Add/Remove Replica In Domain |
9923a32a-3607-11d2-b9be-0000f87a36b2 |
Domain-DNS |
20 |
Query Self Quota |
4ecc03fe-ffc0-4947-b630-eb672a8a9dbc |
ms-DS-Quota-Container |
21 |
Read secret attributes of objects in a Partition |
084c93a2-620d-4879-a836-f0ae47de0e89 |
26f11b08-a29d-4869-99bb-ef0b99fd883e |
22 |
Replicating Directory Changes |
1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 |
DMD, Configuration, Domain-DNS |
23 |
Replicating Directory Changes All |
1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 |
DMD, Configuration, Domain-DNS |
24 |
Replicating Directory Changes In Filtered Set |
89e95b76-444d-4c62-991a-0facbeda640c |
DMD, Configuration, Domain-DNS |
25 |
Manage Replication Topology |
1131f6ac-9c07-11d1-f79f-00c04fc2dcd2 |
DMD, Configuration, Domain-DNS |
26 |
Monitor Active Directory Replication |
f98340fb-7c5b-4cdb-a00b-2ebdfa115a96 |
DMD, Configuration, Domain-DNS |
27 |
Replication Synchronization |
1131f6ab-9c07-11d1-f79f-00c04fc2dcd2 |
DMD, Configuration, Domain-DNS |
28 |
Set Owner of an object during creation |
4125c71f-7fac-4ff0-bcb7-f09a41325286 |
26f11b08-a29d-4869-99bb-ef0b99fd883e |
29 |
Write secret attributes of objects in a Partition |
94825A8D-B171-4116-8146-1E34D8F54401 |
26f11b08-a29d-4869-99bb-ef0b99fd883e |
30 |
Enable Per User Reversibly Encrypted Password |
05c74c5e-4deb-43b4-bd9f-86664c2a7fd5 |
Domain-DNS |
31 |
Generate Resultant Set of Policy (Logging) |
b7b1b3de-ab09-4242-9e30-9980e5d322f7 |
Domain-DNS, Organizational-Unit |
32 |
Generate Resultant Set of Policy (Planning) |
b7b1b3dd-ab09-4242-9e30-9980e5d322f7 |
Domain-DNS, Organizational-Unit |
33 |
Manage Optional Features for Active Directory |
7c0e2a7c-a419-48e4-a995-10180aad54dd |
Cross-Ref-Container |
34 |
Migrate SID History |
BA33815A-4F93-4c76-87F3-57574BFF8109 |
Domain-DNS |
35 |
Open Connector Queue |
b4e60130-df3f-11d1-9c86-006008764d0e |
Site |
36 |
Peek Message |
06bd3201-df3e-11d1-9c86-006008764d0e |
MSMQ-Queue |
37 |
Peek Computer Journal |
4b6e08c3-df3c-11d1-9c86-006008764d0e |
MSMQ-Configuration |
38 |
Peek Dead Letter |
4b6e08c1-df3c-11d1-9c86-006008764d0e |
MSMQ-Configuration |
39 |
Receive Message |
06bd3200-df3e-11d1-9c86-006008764d0e |
MSMQ-Queue |
40 |
Receive Computer Journal |
4b6e08c2-df3c-11d1-9c86-006008764d0e |
MSMQ-Configuration |
41 |
Receive Dead Letter |
4b6e08c0-df3c-11d1-9c86-006008764d0e |
MSMQ-Configuration |
42 |
Receive Journal |
06bd3203-df3e-11d1-9c86-006008764d0e |
MSMQ-Queue |
43 |
Send Message |
06bd3202-df3e-11d1-9c86-006008764d0e |
MSMQ-Group, MSMQ-Queue |
44 |
Open Address List |
a1990816-4298-11d1-ade2-00c04fd8d5cd |
Address-Book-Container |
45 |
Read Only Replication Secret Synchronization |
1131f6ae-9c07-11d1-f79f-00c04fc2dcd2 |
DMD, Configuration, Domain-DNS |
46 |
Reanimate Tombstones |
45EC5156-DB7E-47bb-B53F-DBEB2D03C40F |
DMD, Configuration, Domain-DNS |
47 |
Recalculate Hierarchy |
0bc1554e-0a99-11d1-adbb-00c04fd8d5cd |
NTDS-DSA |
48 |
Recalculate Security Inheritance |
62dd28a8-7f46-11d2-b9ad-00c04f79f805 |
NTDS-DSA |
49 |
Receive As |
ab721a56-1e2f-11d0-9819-00aa0040529b |
ms-DS-Delegated-Managed-Service-Account, ms-DS-Group-Managed-Service-Account, inetOrgPerson, ms-DS-Managed-Service-Account, Computer, User |
50 |
Refresh Group Cache for Logons |
9432c620-033c-4db7-8b58-14ef6d0bf477 |
NTDS-DSA |
51 |
Reload SSL/TLS Certificate |
1a60ea8d-58a6-4b20-bcdc-fb71eb8a9ff8 |
NTDS-DSA |
52 |
Run Protect Admin Groups Task |
7726b9d5-a4b4-4288-a6b2-dce952e80a7f |
Domain-DNS |
53 |
Enumerate Entire SAM Domain |
91d67418-0135-4acc-8d79-c08e857cfbec |
Sam-Server |
54 |
Send As |
ab721a54-1e2f-11d0-9819-00aa0040529b |
ms-DS-Delegated-Managed-Service-Account, ms-DS-Group-Managed-Service-Account, inetOrgPerson, ms-DS-Managed-Service-Account, Computer, User |
55 |
Send To |
ab721a55-1e2f-11d0-9819-00aa0040529b |
Group |
56 |
Unexpire Password |
ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501 |
Domain-DNS |
57 |
Update Password Not Required Bit |
280f369c-67c7-438e-ae98-1d46f3c6f541 |
Domain-DNS |
58 |
Update Schema Cache |
be2bb760-7f46-11d2-b9ad-00c04f79f805 |
DMD |
59 |
Change Password |
ab721a53-1e2f-11d0-9819-00aa0040529b |
inetOrgPerson, ms-DS-Managed-Service-Account, Computer, User |
60 |
Reset Password |
00299570-246d-11d0-a768-00aa006e0529 |
inetOrgPerson, ms-DS-Managed-Service-Account, Computer, User |